v0.7.8: WebUI (--web): HTTP/1.1 + SSE front end, engine API v1, tests

A second implementation of cst_agent_hooks_t next to the TUI: the turn runs on
a worker thread, the hooks publish events into a ring buffer that SSE clients
read, so the engine itself needs no changes.

- src/net.c, include/cst_net.h: POSIX/Winsock sockets, non-blocking connect
- src/http_srv.c, include/cst_http.h: HTTP/1.1, keep-alive, chunked streaming,
  body caps (413), Expect: 100-continue, connection cap, exact routing
- src/web_md.c, include/cst_web_md.h: streaming markdown -> sanitized HTML
  (tag/attribute allowlist, javascript: URLs and off-site images dropped)
- src/webui.c, include/cst_webui.h: event ring + SSE broadcast, all routes,
  token (Bearer/Cookie/query) and loopback Host checks, 3 s auto-deny when no
  client is attached
- src/webui_stub.c, CST_WEBUI=0 / CST_BUILD_WEBUI=OFF: build without the WebUI
- web/: no-build front end (transcript, approvals, todo, sessions, image
  upload, status bar)
- docs/webui.md: engine API v1 - events, requests, security model
- tests/test_webui.c, scripts/e2e_webui.sh: unit tests plus an end-to-end run
  driven by a recorded SSE stream (no API key needed)
- src/main.c: --web --web-port --web-host --web-token --web-dev --web-open
  and CST_WEB_PORT/HOST/TOKEN/ROOT

An empty POST body is now accepted without Content-Length (RFC 9112 6.3) so
curl-driven clients can reach cancel/undo/compact/quit; CMakeList's core tests
learned about sashidown and test_webui, and CST_WEBUI=0 defines CST_NO_WEBUI.

web/style.css

@@ -0,0 +1,103 @@
+:root {
+  --bg: #14161a;
+  --bg2: #1b1e24;
+  --fg: #d8dde5;
+  --muted: #8b93a1;
+  --line: #2a2f38;
+  --accent: #7fb2ff;
+  --ok: #7ddc8f;
+  --warn: #ffcc66;
+  --err: #ff7b72;
+  --tool: #b5e3c8;
+}
+* { box-sizing: border-box; }
+html, body { margin: 0; height: 100%; }
+body {
+  background: var(--bg); color: var(--fg);
+  font: 14px/1.55 ui-monospace, SFMono-Regular, Menlo, Consolas, "Noto Sans Mono CJK SC", monospace;
+  display: flex; flex-direction: column; height: 100%;
+}
+button {
+  background: var(--bg2); color: var(--fg); border: 1px solid var(--line);
+  border-radius: 6px; padding: 3px 9px; font: inherit; cursor: pointer;
+}
+button:hover { border-color: var(--accent); }
+.grow { flex: 1; }
+.muted { color: var(--muted); }
+
+#bar {
+  display: flex; align-items: center; gap: 8px; padding: 6px 10px;
+  border-bottom: 1px solid var(--line); background: var(--bg2);
+  position: sticky; top: 0; z-index: 3; flex-wrap: wrap;
+}
+.tag { border: 1px solid var(--line); border-radius: 999px; padding: 0 8px; color: var(--muted); }
+.tag.on { color: var(--bg); background: var(--accent); border-color: var(--accent); }
+.ws { color: var(--muted); overflow: hidden; text-overflow: ellipsis; max-width: 40vw; white-space: nowrap; }
+.model { color: var(--accent); }
+
+#log { flex: 1; overflow: auto; padding: 12px 14px 20px; }
+#log .msg { margin: 0 0 14px; }
+#log .who { color: var(--muted); font-size: 12px; margin-bottom: 2px; }
+#log .body { white-space: pre-wrap; word-break: break-word; }
+#log .assistant .body > :first-child { margin-top: 0; }
+#log .body pre {
+  background: var(--bg2); border: 1px solid var(--line); border-radius: 6px;
+  padding: 8px 10px; overflow: auto;
+}
+#log .body code { background: var(--bg2); border-radius: 4px; padding: 0 3px; }
+#log .body pre code { background: none; padding: 0; }
+#log .body table { border-collapse: collapse; }
+#log .body th, #log .body td { border: 1px solid var(--line); padding: 2px 6px; }
+#log .body blockquote { border-left: 3px solid var(--line); margin: 0; padding-left: 10px; color: var(--muted); }
+#log .body a { color: var(--accent); }
+#log .body img { max-width: min(420px, 100%); border-radius: 6px; border: 1px solid var(--line); }
+
+details.think { color: var(--muted); margin: 4px 0; }
+details.think summary { cursor: pointer; }
+details.tool {
+  border: 1px solid var(--line); border-radius: 6px; margin: 6px 0; background: var(--bg2);
+}
+details.tool > summary { cursor: pointer; padding: 4px 8px; color: var(--tool); }
+details.tool .args, details.tool pre { margin: 0; padding: 6px 10px; white-space: pre-wrap; }
+details.tool pre { border-top: 1px solid var(--line); max-height: 40vh; overflow: auto; }
+.tool .exit-bad { color: var(--err); }
+.spin::after { content: " …"; color: var(--warn); }
+
+#todo {
+  border-top: 1px solid var(--line); background: var(--bg2); padding: 6px 12px;
+  max-height: 22vh; overflow: auto; white-space: pre-wrap; font-size: 13px;
+}
+#todo h4 { margin: 0 0 4px; color: var(--muted); font-size: 12px; font-weight: normal; }
+
+#composer { border-top: 1px solid var(--line); background: var(--bg2); padding: 8px 10px; }
+#composer .row { display: flex; gap: 8px; align-items: flex-end; }
+#input {
+  flex: 1; resize: vertical; min-height: 34px; max-height: 40vh;
+  background: var(--bg); color: var(--fg); border: 1px solid var(--line);
+  border-radius: 6px; padding: 7px 9px; font: inherit;
+}
+.att {
+  border: 1px solid var(--line); border-radius: 6px; padding: 5px 9px; cursor: pointer;
+}
+.hint { display: flex; gap: 10px; font-size: 12px; color: var(--muted); padding-top: 4px; }
+#pending { color: var(--warn); font-size: 12px; padding-bottom: 4px; }
+
+#modal {
+  position: fixed; inset: 0; background: rgba(0, 0, 0, .55);
+  display: flex; align-items: center; justify-content: center; z-index: 9;
+}
+#modal-box {
+  background: var(--bg2); border: 1px solid var(--line); border-radius: 10px;
+  padding: 14px; width: min(820px, 94vw); max-height: 88vh; overflow: auto;
+}
+#modal-box h3 { margin: 0 0 8px; }
+#modal-box pre {
+  background: var(--bg); border: 1px solid var(--line); border-radius: 6px;
+  padding: 8px; max-height: 46vh; overflow: auto; white-space: pre-wrap;
+}
+#modal-box .buttons { display: flex; gap: 8px; flex-wrap: wrap; margin-top: 10px; }
+#modal-box .danger { border-color: var(--err); color: var(--err); }
+#modal-box .ok { border-color: var(--ok); color: var(--ok); }
+.sess { display: flex; gap: 8px; align-items: center; padding: 4px 0; border-bottom: 1px solid var(--line); }
+.sess .id { color: var(--muted); font-size: 12px; }
+.sess .t { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }